Disclosure: I build Formgong, a form backend. Three of the pages below belong to companies like mine, and I say which.
If you search "html contact form code", you get pages with a form you can copy. I wanted to know how many of those forms would actually deliver a message if you pasted them into a site today.
On 13 October 2026 I took the top 10 pages for four searches ("html contact form code", "html contact form", "contact form html css", "simple contact form html"), merged by rank, skipping pages with no copyable code (a Scribd PDF, a Medium post with the code only as screenshots, and a page that now redirects to a form-builder tool). One page was down ("Site unavailable"), so 9 were judged. I wrote the checks down before opening the first page, and I only read the code. Nothing was submitted anywhere.
The checks
-
Does it send? The form has an
actionpointing at something that exists, or the page gives the backend code.action="#", no action, or JavaScript that only shows "Thanks" count as no. -
Labels. Every field has a
<label>tied to it. A placeholder alone doesn't count. -
type="email"on the email field. -
requiredon name, email and message. -
autocompleteon name and email, so phones and password managers can fill them. - Any spam protection in the snippet: a honeypot, a captcha, a server check.
- If JavaScript sends it: does it show an error when the request fails?
Results
| Page | Owner | Sends | Labels | type=email | required | autocomplete | Spam |
|---|---|---|---|---|---|---|---|
| Formspree library | form backend | yes, after signup | yes | no | no | no | not in snippet |
| Medium (Cwrcode) | independent | no | no | yes | no | no | no |
| GeeksforGeeks | independent | yes (PHP) | no | yes | no | no | no |
| TemplateMonster Help (2011) | independent | yes (PHP) | no | no | no | no | no |
| freeCodeCamp | independent | no | no | yes | yes* | no | no |
| TutorialsPoint | independent | no | yes | yes | yes | no | no |
| a Lovable-built blog | independent | no | yes | yes | yes | no | no |
| Web3Forms | form backend | yes, after signup | no | yes | yes | no | not in snippet |
| Formcarry blog | form backend | yes | yes | yes | no | no | no (PHP version) |
The totals:
- 5 of 9 send anywhere. Three of those five are form-backend companies, which is fair: sending is what they sell.
- Of the 6 independent pages, 2 send, and one of the two can't be submitted as shown (see TemplateMonster below). So 1 of 6 gives code that delivers a message as pasted.
- 3 of the 4 forms that don't send never tell the reader.
-
0 of 9 set
autocomplete. 0 of 9 have spam protection in the code itself. The three backend companies say they filter on their side; I didn't test that. - The only snippet that submits with JavaScript shows "Thank you" without making a request at all.
Four things worth seeing in the code
The fields have no names. The Medium post's form has inputs for name, email and phone, and none of them has a name attribute. Browsers only send fields that have a name. Even with a working backend behind it, the message would arrive with the country code and the text, and nothing that tells you who wrote it:
<input type="text" size="33" placeholder="Enter Your Name" id="firstname" autofocus />
<input type="email" id="eid" placeholder="Enter Your Email" size="33" />
The Send button disappears. The TemplateMonster article from 2011 shows its textarea with a <br> after it and no closing tag. A browser keeps reading everything after an unclosed <textarea> as its text, including the button. Parsed in Chrome, the form has zero submit buttons. Its PHP also builds the From and Reply-To headers from a variable the script never defines.
An empty message passes required. freeCodeCamp's form posts to action="#", so it sends nothing, and the tutorial doesn't mention that. The labels point at ids the inputs don't have. And the textarea ships with a space inside:
<textarea name="message" cols="30" rows="10" placeholder="Enter your message here ..." required> </textarea>
That space is the field's value, so the browser treats it as filled. In Chrome, validity.valueMissing is false for a message nobody typed.
Copy it as-is and you CC a stranger. GeeksforGeeks is the one independent page whose code would deliver, on a PHP host where mail() works. Its PHP adds a fixed header:
"CC: somebodyelse@example.com";
Paste it unchanged and every message also goes to example.com.
One more, from a backend company's own page: Formcarry's PHP example checks the name and email with patterns that reject o.brien+site@gmail.com, ann@studio.agency, José García and Олена Коваль. I tested the two patterns with Python's re, not PHP, because PHP isn't installed on my machine.
What a contact form that works needs
This is the checklist I'd use before pasting any snippet:
<form action="https://your-endpoint.example/submit" method="POST">
<label>Name <input name="name" required autocomplete="name"></label>
<label>Email <input type="email" name="email" required autocomplete="email"></label>
<label>Message <textarea name="message" required></textarea></label>
<!-- honeypot: hidden from people, bots fill it, the server drops those -->
<div hidden><label>Leave empty <input name="botcheck" tabindex="-1" autocomplete="off"></label></div>
<button type="submit">Send</button>
</form>
- An
actionthat points at something that really sends. Then send yourself one test from the live page and check the inbox. - A
nameon every field. Without it the value never leaves the browser. - Labels wrapped around or tied to each field,
type="email",required, andautocomplete. - No whitespace between
<textarea>and</textarea>. - Some spam check, even a honeypot.
- If you send with
fetch, show an error when the request fails. A "Thanks" that appears no matter what is worse than no form.
We put these rules into the free form generator on our site. It writes the same form as HTML, Tailwind, Bootstrap, React or Vue. It posts to Formgong, so it needs a key (there's a free plan). If you have your own backend, copy the markup and change the action.
To check a form that is already live, paste the page address into our form checker. It reads the page's HTML and reports a missing action, fields without names or labels, a lost submit button and a whitespace-filled required textarea. It works with any form backend and never submits anything.
The method, the full results and the failing line from every snippet are in a public repo: formgong/html-snippet-study. If you want a page I didn't quote, ask in the comments.
Tell me what I missed
Which tutorial did you copy your first contact form from, and did it work? If you know a snippet that passes all seven checks, post it below. I'll add it to the table.

Top comments (0)